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Preface 


This report summarizes the discussions at a seminar organized and hosted by the RAND 
Corporation at which a group of acting and former senior government and law enforcement 
officials, practitioners, and experts examined domestic intelligence operations and information 
sharing as these relate to terrorist threats. The collective experience of the participants spanned 
the breadth of the homeland security apparatus. The participants included officials who have 
served or are serving in the Department of Homeland Security (DHS), the Federal Bureau 
of Investigation (FBI), the Central Intelligence Agency (CIA), the Department of Defense 
(DoD), state and local law enforcement agencies, first-responder organizations, and state-level 
homeland security agencies. A similar group met three years ago to discuss lessons learned 
from avoiding terrorist attacks at home, the role of DHS’s Bureau of Intelligence and Analysis, 
and the value and focus of fusion centers. One of the goals of the meeting reported here was 
to measure how much progress was being made (or not made, as the case may be) in several 
critical areas of homeland security. 

‘The seminar was conducted within RAND’s continuing program of self-initiated research. 
Support for such research is provided, in part, by donors and by the independent research and 
development provisions of RAND’s contracts for the operation of its U.S. Department of 
Defense federally funded research and development centers. 


The RAND Homeland Security and Defense Center 


‘The conference was sponsored jointly by the RAND National Security Research Division and 
RAND Justice, Infrastructure, and Environment. RAND Justice, Infrastructure, and Envi- 
ronment provides insights and solutions to public- and private-sector decisionmakers across 
numerous domains, including criminal and civil justice; public safety; environmental and nat- 
ural resources policy; energy, transportation, communications, and other infrastructure; and 
homeland security. The RAND National Security Research Division conducts research and 
analysis for all national security sponsors other than the U.S. Air Force and the Army. 

Questions or comments about this report should be sent to the project leader, Brian 
Michael Jenkins. He can be reached by email at Brian_Jenkins@rand.org or by phone at 310- 
393-0411, ext. 6288. 
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Summary 


This report summarizes a daylong, in-depth seminar, hosted by the RAND Corporation, at 
which a group of acting and former senior government and law enforcement officials, practi- 
tioners, and experts discussed domestic intelligence operations and information sharing as 
these relate to terrorist threats. The collective experience of the participants spanned the breadth 
of the homeland security apparatus. The participants included officials who have served or are 
serving in the Department of Homeland Security (DHS), the Federal Bureau of Investiga- 
tion (FBI), the Central Intelligence Agency (CIA), the Department of Defense (DoD), state 
and local law enforcement agencies, first-responder organizations, and state-level homeland 
security agencies. Several RAND analysts who have written on and thought about homeland 
security issues for decades also participated. The discussions were unofficial and nonpartisan. 

The goal of the seminar was not to solve perennial problems but rather to elicit the views 
of a diverse and experienced group of officials with very different perspectives and opinions 
on the threat of terrorism to the United States and what might be done about it. With these 
divergent perspectives in mind, the following areas of agreement emerged. 

The terrorist threat has changed, although disagreement about its direction and 
scope persists. From a strategic perspective, al Qaeda is greatly diminished; its ability to 
launch another catastrophic attack has been substantially reduced. The terrorist threat is now 
more diverse and complex, and from a local perspective, it is still challenging and dangerous. 
Moreover, it seems likely to persist. 

Local law enforcement focuses on how the terrorist threat manifests itself within the 
communities the agencies protect. Violence spreading to new regions overseas can impact 
local U.S. communities, sparking radicalization and eventually violence. The global jihad is 
no longer the sole organizing principle behind this violence. Rather, locally focused al Qaeda 
offshoots in Yemen, Iraq, Somalia, and North Africa and emerging extremist groups and con- 
flict elsewhere in places like Nigeria and Mali and the countries affected by the Arab upris- 
ings, especially Syria, are the concern of not only our foreign-focused federal agencies but also 
homeland security agencies and state and local entities. 

Categorizing threats by group and compartmenting them by origin (terrorism, 
domestic terrorism, cyber terrorism, etc.) may unduly limit intelligence sharing and 
cooperation and pertains more to past threats than likely future threats. ‘The cyber threat, 
organized crime, narco-traffickers, and terrorists might intersect, yet law enforcement and 
intelligence agencies are disconnected and not positioned to detect an intersection among dis- 
parate groups. 

Building national resilience will require a more composed and nuanced national 
dialogue that starts in Washington. The rigid diktat that all terrorism must be prevented 
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and Washington’s tendency to focus on fault-finding rather than improving performance are 
counterproductive. 

Joint Terrorism Task Forces (JTTFs) remain the central construct of the domestic 
counterterrorist structure. Better investigative cooperation with state and local entities could 
be achieved by removing unnecessary obstacles that prevent consistent and quality cooperation 
between the JI'TFs and local police. 

Some of the obstacles that limit cooperation, information sharing, and collabora- 
tion among the various layers of government were put in place for good reason. Privacy 
and civil-liberties protections must be at the forefront in rethinking relationships and breaking 
down barriers. 

Privacy and civil liberties should not be used as a blanket excuse to keep the intelli- 
gence community and local law enforcement apart. We should think about how to remove 
barriers that prevent cooperation and communication between these two communities that 
have much to benefit and learn from each other. 

The intelligence community has much to offer local police, and vice versa. For exam- 
ple, the intelligence community can provide analytic tradecraft, understanding of the adver- 
sary, and national-level technical collection. Local law enforcement can provide information 
that would assist federal intelligence agencies. 

Fusion centers seem to fall short both with their local customers and in contributing 
to the national-level counterterrorism effort. Some fusion centers are performing well, but 
many are not. Some sort of market system that reduces duplication, harnesses existing exper- 
tise, encourages more cooperation, and normalizes protocols could reduce costs and improve 
effectiveness. 

It is difficult for national intelligence structures to talk about domestic terrorism, 
i.e., terrorism conducted by purely domestic violent extremists on the far left or far right 
of the political spectrum or extremists motivated by specific issues. National security has 
a foreign-intelligence focus. Political discomfort precludes the deployment of federal agencies 
against Americans, although the FBI and the Bureau of Alcohol, Tobacco and Firearms have a 
long history of pursuing terrorist groups. 

The nation’s zero tolerance for terrorism may soon come into direct conflict with the 
need to reduce budgets, including, perhaps for the first time, to consider real declines in 
counterterrorism funding. ‘This raises a broader question: What is the end state? Must the 
nation realistically tolerate some level of terrorist risk, and if so, what is that level? 
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Identifying Enemies Among Us: Evolving Terrorist Threats and 
the Continuing Challenges of Domestic Intelligence Collection 
and Information Sharing 


Introduction 


This report summarizes the discussions at a daylong, in-depth seminar, hosted by the RAND 
Corporation, at which a group of acting and former senior government and law enforcement 
officials, practitioners, and experts discussed domestic intelligence operations and information 
sharing as these relate to terrorist threats. The collective experience of the participants spanned 
the breadth of the homeland security apparatus. The participants included officials who have 
served or are serving in the Department of Homeland Security (DHS), the Federal Bureau 
of Investigation (FBI), the Central Intelligence Agency (CIA), the Department of Defense 
(DoD), state and local law enforcement agencies, first-responder organizations, and state-level 
homeland security agencies. Several RAND analysts who have written on and thought about 
homeland security issues for decades also participated. The discussions were unofficial and 
nonpartisan. 

‘The goal of the seminar was not to solve perennial problems but rather to elicit the views 
of a diverse and experienced group of officials with very different perspectives and opinions 
on the threat of terrorism to the United States and what might be done about it. With these 
divergent perspectives in mind, we sought also to make some suggestions for possible course 
corrections. 

Participants were selected with several factors in mind. It was important that they not 
be constrained by their current or previous positions in government. We encouraged all par- 
ticipants to think outside of bureaucratic stovepipes and to avoid defending or attacking any 
particular parochial position but rather to think about homeland security, specifically domes- 
tic intelligence, as a broader structural enterprise. All were encouraged to speak their minds 
(and had demonstrated a willingness to do so). To facilitate frank discussion, we invoked the 
Chatham House Rule, wherein participants are free to use the information received, but nei- 
ther the identity nor the affiliation of the speaker, nor that of any other participant, may be 
revealed. To further facilitate a free exchange of views, participants (other than those respon- 
sible for summarizing and reporting the discussion) were promised anonymity. These guide- 
lines were adopted to enable participants to speak their minds regardless of their position in 
government and to discourage readers from trying to connect thoughts to organizations. We 
were rewarded with a lively debate. 

The seminar was planned before the Boston Marathon bombing and took place in the 
immediate aftermath of that event. The Boston attack vividly demonstrated domestic vulner- 
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ability to terrorism and the resonance that al Qaeda’s message continues to have for a hand- 
ful of individuals in the West. It also demonstrated the hold that terrorism still has on the 
nation’s psyche. The near-continuous stream of media attention to the attack—and especially 
to discussions of which intelligence signals might have been missed, who missed them, and 
how such events might be avoided in the future—captured the nation’s attention for weeks. 
However, we did not want this one attack to dominate our discussions. Instead, we aimed for a 
more wide-ranging and strategic inquiry about the enduring challenges of supporting counter- 
terrorism through effective and acceptable intelligence practices. Inevitably, the causes of the 
Boston attack, the perpetrators, and the responses affected our discussion, but they did not 
dominate it. 

Participants focused on three issues. First, we wanted to explore perceptions of the evolv- 
ing terrorist threat—principally, the current state of al Qaeda, but also other terrorist threats to 
the country. Second, we discussed the state of information sharing, both among agencies of the 
federal government and, more importantly, between federal agencies and state and local part- 
ner entities. Finally, we touched on the current role of the fusion centers, with the backdrop 
of negative recent reports from Congress and the Government Accountability Office (GAO).! 

This report summarizes the key themes that emerged from the discussions. It does not 
attempt to impose an artificial consensus on the group where one did not clearly exist, nor does 
it attempt to offer an agreed-upon assessment of the current state of the “war on terrorism” or 
a report card on government performance. Instead, the ideas discussed serve as a starting point 
for a discussion of the nation’s counterterrorism efforts and the development of new strategies 
where current ones are deemed to have fallen short. 

A similar meeting was held more than three years ago.” Roughly half of the participants 
at the meeting reported here also attended the 2009 meeting. We were curious to explore 
how thinking has changed during the intervening years. At the earlier meeting, the group 
concluded that the terrorist threat was evolving. Al Qaeda was hurting, although in 2010 the 
number of al Qaeda—inspired domestic cases appeared to be on the rise. Participants at the 
earlier meeting also concluded that more than eight years after 9/11, the country still lacked 
a coherent national domestic intelligence effort. The lack of terrorist attacks in the United 
States could be credited to the inability of al Qaeda to radicalize and recruit a large number of 
homegrown terrorists and to a largely successful domestic intelligence effort, which, despite its 
shortcomings, managed to uncover most of the terrorist plots. Participants in the earlier meet- 
ing wondered what role the fusion centers played or should play in a nationwide counterterror- 
ist intelligence effort. 

We found a good number of continuities from the earlier meeting to this one. The threat 
has evolved in different ways than expected, both abroad and domestically, but many of the 
issues raised three years ago remain of central concern today. 


' U.S. Government Accountability Office, 2013; Permanent Subcommittee on Investigations, 2012. 


2 The so-called “319 Group” (derived from the date of its initial meeting) first met in March 2009. A second meeting was 
held in September of that year, followed by extensive exchanges and commentary via email, leading to an unpublished but 
widely circulated report in 2010. An augmented, but still small group met at the RAND Corporation’s offices in Washing- 
ton, D.C., on May 14, 2013. 
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The Current Terrorist Threat 


Perceptions of the current terrorist threat have changed over the past decade. In the immediate 
shadow of the terrorist attacks on September 11, 2001, intelligence efforts focused on prevent- 
ing another catastrophic terrorist attack from abroad. There was also concern that al Qaeda 
sleeper cells might already be present in the United States. They turned out not to exist—there 
was no jihadist underground in place, although al Qaeda has inspired a number of local ter- 
rorist plots since 9/11. 

The dispersal of al Qaeda’s training camps in Afghanistan and the death or arrest of key 
figures have degraded al Qaeda’s operational capabilities, especially those of its central com- 
mand in Pakistan, while improvements in intelligence and unprecedented international co- 
operation have made the terrorists’ operating environment more hostile. None of this, however, 
seems to have dented al Qaeda’s determination. Always resilient, it has morphed to exploit 
new opportunities in North Africa and the Middle East.? Al Qaeda’s affiliates’ current pre- 
sumed operational capabilities are sufficiently lethal and their supposed geographic range is 
extensive enough to make the U.S. government close 19 diplomatic offices on the strength of 
reports indicating a terrorist threat. Although the closures took place while these proceedings 
were being reviewed and edited, they reflect assessments that were in place at the time of the 
conference. 

Today’s threat environment is more diffuse.* Al Qaeda is more decentralized, more 
dependent on its affiliates and allies, and reliant on its ability to inspire homegrown recruits 
to carry out terrorist attacks. It is still unquestionably a dangerous organization, but its abil- 
ity to launch a 9/11-scale spectacular has been substantially lessened, if not eliminated. 
Al Qaeda’s international plotting persists, but fewer of the plots are core-connected. Al Qaeda 
affiliates and homegrown terrorist plots now constitute a bigger part of the threat. While 
al Qaeda remains committed to ambitious strategic attacks, it also has embraced “do-it-yourself” 
terrorism, exhorting followers to do whatever they can, wherever they are. Thus far, however, 
its efforts to mobilize homegrown terrorists have achieved only limited success.° 

Al Qaeda has exploited the turmoil created by the political upheavals in Libya, Tunisia, 
Egypt, Yemen, and Syria. The distraction of established security mechanisms in the region has 
created a more permissive environment for militants and extremists—both those with links to 
al Qaeda and like-minded, locally focused groups across the region, including in the Sahara, 
the Sahel, the Sinai Peninsula, Yemen, and Syria. In Afghanistan, al Qaeda, although weak- 
ened, remains well positioned to benefit from Taliban advances as U.S. and allied forces with- 
draw. And as evidenced by recent revelations, al Qaeda’s presence and abilities overseas remain 
active, especially in the Arabian Peninsula. 

The threat of domestic radicalization has not gained the kind of traction some thought 
it might five years ago, when authorities became aware of a number of Somali-Americans 
who were returning to Mogadishu to fight alongside al Qaeda affiliate al Shaba’ab. (There 
is now concern about Western recruits going to fight in Syria’s civil war.) Despite more than 
200 arrests in the United States since 9/11 for providing material support to jihadist groups 


3 Olsen, 2012. 
4 Senate Select Committee on Intelligence, 2013. 


> Jenkins, 2012a, b. Al Qaeda’s ability to inspire homegrown terrorists is addressed in Jenkins, 2011. See also Jones, 2013; 
Liepman, 2013. 
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or, more seriously, for plotting terrorist attacks in the United States, few homegrown opera- 
tives have proven to be determined or very skillful. (This does not mean they are not danger- 
ous.) Nevertheless, authorities continue to interrupt local terrorist conspiracies. There could be 
another surge of terrorist plots on the home front, but the success rate of the authorities has 
been good. 

The Director of National Intelligence (DNI), James Clapper, summarized this situation 
in his “worldwide threats briefing” to Congress on March 12, 2013, saying, “The threat from 
core al Qaeda and the potential for a massive coordinated attack on the United States is dimin- 
ished, but the global jihadist movement is a more diversified, decentralized, and persistent 
threat. Lone wolves, domestic extremists and jihadist inspired groups remain determined to 
attack western interests as they've done most recently in Libya and Algeria.”6 

While al Qaeda remains the most salient immediate concern, other potential threats 
have also emerged since the “319 Group” meeting: Iranian and Hezbollah operatives have 
attempted or carried out terrorist attacks in Thailand, India, Georgia, Kenya, Cyprus, and Bul- 
garia. These foiled plots and successful attacks were directed against Israeli targets, but given 
Iran’s and Hezbollah’s past involvement in terrorist attacks on American targets abroad, and 
in view of continuing U.S. tensions with Iran, they have raised concerns in the United States. 
‘These concerns were underscored by the discovery of an Iranian plot to assassinate the Saudi 
ambassador in Washington, D.C. ‘The attack was planned by a naturalized American citizen 
of Iranian origin who was recruited by a cousin serving in Iran’s Revolutionary Guard Force— 
Quds Force, which has been designated by the Treasury Department as a terrorist supporter 
for providing material support to terrorism. The plotter was described by Preet Bharara, the 
U.S. Attorney for the Southern District of New York, as “an enemy among us.”’ It is not clear 
whether the plot was an anomaly or a calculated risk, but the political consequences, had it 
succeeded, would undoubtedly have been grave. 

At the same time, Mexico’s criminal cartels seem to be increasing their efforts to control 
illegal drug-distribution networks north of the border, raising concerns that Mexican-style vio- 
lence—kidnappings, mass murders, bombings, beheadings—will come north and that crimi- 
nal networks moving money, drugs, weapons, and aliens across the southwest border could be 
exploited by terrorist organizations. 

With these observations as the context for our discussion about trends in the terrorist 
threat, several themes emerged. To some of the participants, mostly those at the federal level, 
the trajectory of America’s principal terrorist adversary, al Qaeda, seemed clear. Al Qaeda’s core 
group has been significantly diminished, presenting a shadow of its former threat. Continued 
pressure on the group’s safe haven in Southwest Asia for more than a decade has devastated 
its capabilities and rendered it far less capable. Overall, the quality of al Qaeda terrorism has 
declined. Moreover, homegrown terrorism has not increased as some thought it might three 
years ago. 

But other participants, primarily at the local level, saw little letup in the threat. Indeed, 
they expressed concern that the threat may even be moving in the wrong direction. The latter 
view is underscored by some worrisome trends at home and abroad: 


© Clapper, 2013. 
7 U.S. Department of Justice, 2013. 
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¢ Several terrorist plots (including the Boston bombing) were uncovered in the United 
States in the six months before the conference.’ Despite Osama bin Laden’s death, the 
rhetoric of “global jihad” continues. Jihadist vitriol is increasing on social media such as 
Facebook, according to several participants familiar with efforts to observe these trends. 
The United States is viewed by some as hostile to Islam and complicit in the oppression 
of Muslim militants in the United States and abroad. It is impossible to predict exactly 
how this anti-American sentiment could develop over the coming years, but it should be 
possible to enumerate the most likely developments. 

¢ More al Qaeda affiliates are appearing, and they have more sanctuaries in more territo- 
ries. The conflicts currently raging in North Africa and the Middle East have attracted a 
growing number of jihadist volunteers from around the world, including North Amer- 
ica. Eventually, some of these veterans—battle-hardened and experienced—will want to 
return to the United States or may be sent here by al Qaeda or its affiliates to launch ter- 
rorist attacks. This may pose a long-range domestic terrorist threat. 

¢ Other extremist groups overseas also could attract adherents within U.S. communities. 
And we must not ignore the possible emergence of local manifestations of a growing list 
of extremely violent “jihadi” organizations around the world, including Boko Haram in 
Nigeria, Ansar al Sharia in Tunisia and Libya, Ansar al Din in Mali, and al Nusrah in 
Syria. The proliferation of a new generation of extremist groups abroad could provoke 
actions to express long-held grievances or protest U.S. activities overseas. 


From this perspective, America’s terrorist foes remain determined and active, and terrorist 
plots continue to arise. As one participant noted, “There is a permanency to this. It cannot be 
redefined as a nuisance.” Americans suffer from “terrorism fatigue,” but the nation’s expecta- 
tion of 100-percent security—zero tolerance for any attack—demands constant vigilance. 

In addition to the debate over whether the overall terrorist threat has declined or remained 
steady, participants made a number of more specific observations: 


° Ideologically, al Qaeda remains committed to attacking the U.S. homeland. While its 
central leadership has been decimated, it remains involved in the organization’s global 
terrorist campaign. Al Qaeda’s ability to attack the homeland has been significantly 
degraded but not eliminated. 

¢ ‘There are significant disparities among al Qaeda’s affiliates: the Belmokhtar faction of 
al Qaeda in the Islamic Maghreb (AQIM) carried out a large-scale assault on the Amenas 
gas facility in Algeria. Al Qaeda in the Arabian Peninsula (AQAP), the affiliate most 
active in the global terrorist campaign—indeed, widely believed responsible for the most 
recent threat that culminated in closing embassies across the Middle East and far into 
Africa—benefits from a technically savvy bomb designer who built the devices used in 
repeated attempts to sabotage U.S.-bound aircraft and who is still at large. Al Qaeda in 
Iraq (AQI) appears to have recovered during the past several years and is escalating its 
terrorist campaign, while al Qaeda’s newest affiliate in Syria is rapidly acquiring combat 
experience and skills, although al Shaba’ab in Somalia appears to be trending down. 


8 The most recent plots include Quazi Mohammad Rezwanul’s plan to attack the Federal Reserve in New York, Chiheb 
Esseghaier’s plan to bomb a U.S.-bound train in Canada, and the Qazi brothers’ plot to attack various targets in New York. 


6 Identifying Enemies Among Us 


¢ Al Qaeda’s homegrown plotters are not sophisticated, but they are still dangerous. The 
level of sophistication could change if terrorist skills acquired in Syria and Iraq were to 
flow back into the United States. 

¢ America’s closest allies are spending less on counterterrorism and devoting less atten- 
tion to it. Partnerships with foreign intelligence services remain critically important to 
the United States, providing information to interrupt terrorist plots against U.S. targets 
abroad as well as some domestic plots. The Arab uprisings have disrupted security rela- 
tionships while creating potential terrorist safe havens. 

¢ Public outreach efforts can take at least partial credit for limiting domestic radicalization 
(certainly in comparison with what participants expected the last time they met). There 
is room to improve in this area. 

¢ ‘The resonance of Osama bin Laden’s message (indeed, by most measures, the popular- 
ity of al Qaeda itself) has decreased, although participants admitted that it was hard to 
assess this. Polling is not very reliable, but the results are encouraging.® At the same time, 
al Qaeda’s brand still appears to be attractive to local jihadist groups that have arisen in 
Africa and the Middle East. 

¢ We should resist writing epitaphs. AQI is an apt example. When the U.S. forces departed 
from Iraq in 2011, the terrorist group was foundering. Now, only two years later, it is help- 
ing to spearhead some of the most successful attacks against the Syrian regime. Sunni- 
controlled territory in Syria is becoming an al Qaeda stronghold, and there is very little 
the United States can do about that without a major military intervention. At the same 
time, AQI has launched its bloodiest attacks in years against Shia targets in that country. 
Its resurgence is a reminder of al Qaeda’s overall resilience and the risks of declaring vic- 
tory too soon. The same is true in Yemen, Somalia, and the Sahel, where al Qaeda affili- 
ates have been damaged by continuing military operations but are by no means finished 


off. 10 


Beyond al Qaeda, several other issues will impact the nature of the terrorist threat and the 
level and type of effort the United States will have to mount. Iranian operatives and Hezbol- 
lah have been increasingly active around the world. Although neither Iran nor Hezbollah has 
attacked the United States in recent years, events in the Middle East point to increasing ten- 
sions. In Syria, the United States is pitted against offshoots of al Qaeda on the one hand and 
the Assad regime with its allies Hezbollah and Iran on the other. Hezbollah declared its alli- 
ance with President Assad, while more recently, the United States declared its support for the 
rebels. Hezbollah’s (and Iran’s) record of using unconventional tactics (including terrorism) is 
well established. We don’t really understand Iran and the Quds Force. The recent discovery of 
a bizarre plot to assassinate the Saudi ambassador in Washington underscores Iran’s willingness 
to carry out actions in the United States, although it may try to disguise its role. While much 
of what Hezbollah currently does in the United States seems related to ordinary crime (and 
it seems unlikely that cigarette smugglers would be Hezbollah’s top choice for terrorist opera- 
tives), events in Syria and the enduring U.S.-Iran differences make this aspect of the terrorist 
landscape unpredictable but potentially dangerous. 


9 Pew Research Center, 2012, 2013. 
10 Clapper, 2013. 
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Participants at the meeting also thought about the threat in broader terms. Critics of U.S. 
counterterrorist efforts exhort authorities to look forward to the next threat rather than back- 
ward at the last one. This is always a wise suggestion but one that is difficult to implement. Not 
surprisingly, we are better at describing and preparing for events that have happened than we 
are at anticipating what the next threat might be. At the tactical level, there are numerous ter- 
rorist scenarios to prepare for, many of which would require significant security expenditures, 
but resources are finite. In the absence of an attack, it is difficult to justify the expense of secu- 
rity measures, but once an event occurs, it is almost impossible to resist pressure to implement 
whatever is deemed necessary to prevent a recurrence. 

Lacking anticipatory intelligence, we also tend to be reactive at the strategic level. Can we 
do better at anticipating the kinds of threats—not tactics—that are likely to affect homeland 
security in the years ahead and adjust efforts accordingly? More alternative analysis and red- 
cell exercises and more frequent interaction between the strategic analysts in Washington and 
local authorities might help. What is the correlation between what is happening overseas and 
what local authorities are sensing on the ground? 

There appeared to be a divide among the participants on this issue. Most of those at 
the more strategic, federal level focused on the relative capabilities of the terrorist enemy and 
judged that more than a decade of effort had eroded those capabilities. Local law enforcement, 
on the other hand, is obliged to view threats pragmatically and thus focuses not on how much 
the threat has diminished but rather on what remains of it and how it has evolved since 9/11. 

The definitions that determine the bureaucratic jurisdictions of federal agencies do not 
apply to local authorities, whose jurisdictions are geographic, not bureaucratic. Their mission is 
to protect citizens within their jurisdictions against all threats. Some local authorities say they 
are seeing a convergence between terrorism and criminal enterprises such as the drug cartels, 
organized crime, international gangs, and human traffickers. These criminal threats are not 
ignored by federal agencies, but they are not seen as falling within the framework of national 
security and certainly not within the definitions of terrorism that dictate federal missions. As a 
practical matter, how can local intelligence efforts aimed at both violent extremists and crimi- 
nal organizations that may employ terrorist tactics engage with federal agencies when the two 
are divided by statute? 

‘This raises the question, Is our nomenclature outdated? The tendency to sort threats into 
defined and bounded categories seems better suited to the past than to the future. The dis- 
tinctions we draw between al Qaeda’s core, affiliates, and acolytes may divide our focus rather 
than increase our ability to perceive changes in the threat. ‘The local police force that is trying 
to prevent an attack perceives the “threat” as something very different from that perceived by 
a strategic analyst in Washington who is trying to estimate the capacity of an enemy to strike. 
The distinctions that strategic analysts make among the various terrorist groups, their motiva- 
tions, and their affiliations matter less at the local level, where the main challenge is to devise a 
response plan to an attack, regardless of whether the perpetrator is al Qaeda core, an affiliate in 
Somalia, a Shia group linked to Iran, a homegrown terrorist motivated by jihadist ideology, a 
nationalist-inspired Muslim from Dagestan, a neo-Nazi with abundant firearms and the intent 
to kill, or even a criminal cartel using terrorist tactics to intimidate the state. 

‘The terrorism nomenclature developed over the past decade may not be appropriate for 
the threats the United States will face tomorrow and could cause U.S. authorities to miss an 
emerging threat. References to this issue recurred throughout the discussion, reflecting a vague 
sense of unease but without a clear conclusion. This issue merits more analysis. 
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The Challenges of Domestic Intelligence 


DHS wants intelligence-driven, risk-based security. How can intelligence deliver that? The 
United States has come a long way since 9/11, but many challenges remain. 

‘There is widespread terrorism fatigue, and there are serious budget constraints. As the 
country emerges from the long shadow of 9/11, there have been mounting attacks on domestic 
intelligence operations. Secret government surveillance programs, often highly sensitive and 
thus necessarily secret, are not always well explained, contributing to public suspicion and 
growing debate. 

The intelligence community is still fragmented in terms of describing what intelligence 
should be collected and for what purposes. Its many components are still operating indepen- 
dently—the community cannot talk as a community. “This is a rare group,” one participant 
noted. “It has no counterpart in government. I am not even sure a dialogue like this can go on 
in government. We may be the only people who are trying to create a hybrid system of shar- 
ing intelligence and information.” Another participant observed that “we're not leveraging 
all the capability of the local and state entities (much less federal); there’s no true whole-of- 
government approach.” 

Some see the federal role as combating the high-end threats, reducing the likelihood of 
catastrophic events, maintaining a capability to detect and prevent large-scale attacks involv- 
ing weapons of mass destruction (WMD) and smaller-scale events involving unconventional 
weapons the best it can and increasing its ability to detect Boston-type events. This is where the 
danger now comes from—the low-level threats that don’t get watched. But the FBI cannot do it 
all. As the Boston bombing demonstrates, threats that are low-level in organization, resources, 
and technology can nonetheless deliver deadly attacks and cannot be dismissed as “low level” 
and therefore somehow belonging outside the FBI’s efforts to detect and interdict homegrown 
terrorist plots. What is the right balance between federal agencies and local law enforcement? 

Many agree that local police departments are better positioned to collect domestic intel- 
ligence than federal investigators, although only a few police departments have the resources 
and public support to do so. Furthermore, many local communities have lost interest in ter- 
rorism (except perhaps for a brief spike after the Boston bombing), which they believe is no 
longer the preeminent threat to the homeland. The prevailing perspective among the public, 
particularly outside the beltway, is that terrorism is gone. If the nation is going to depend on 
local police intelligence efforts, how will it keep an eye on them to do more? And with budgets 
strapped at federal and local levels, who will provide the necessary resources? If federal and 
local funds are inadequate, states seem unlikely to provide the necessary additional funds. 

The declining budget environment will force government to make tough choices, although 
some participants at the meeting pointed out that terrorism has not lost money in the federal 
budget. At least, not yet. However, many police departments are losing resources that are 
needed to do investigative activity, and that will affect their willingness and ability to assume 
an intelligence role they see as a federal responsibility. Many local police departments admit 
candidly that they want the federal authorities to inform them of terrorist threats, freeing them 
from dedicating local resources to intelligence. 

Counterterrorism is not just about daring raids and drone strikes. It is about the hard 
work of collecting and sifting through vast amounts of information, managing relationships 
among prickly organizations that often regard sharing information as an unnatural act. Large- 
scale enterprises involving multiple government agencies and multiple levels of government are 
difficult to manage. “It will take twenty years to get the DHS to work,” remarked one partici- 
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pant. None of the participants favored major structural changes. “We have to work with what 
we've got and try to make it work better.” 


Are Information-Sharing Mechanisms Working? 


Terrorism-related intelligence moves from the local level to the federal level primarily through 
the FBI-led Joint Terrorism Task Forces (JTTFs).!! That seems to be the only route. For a 
variety of reasons, the National Counterterrorism Center (NCTC) and DHS do not directly 
receive local intelligence. In addition to statutory limitations and a reluctance, for political 
reasons, to be seen engaged in domestic “spying,” many at the federal level are persuaded that 
local reporting does not contain much that is useful to them. It is true that an unfiltered flow 
of local information could result in a deluge of material of doubtful value. 

The problem is exacerbated by the uneven intelligence capabilities of local authorities. 
But the dismissive attitude at the federal level also reflects a persistent view that truly valuable 
intelligence will come to federal agencies first. This was certainly true on 9/11 and immedi- 
ately after, when the terrorist threat came primarily from abroad. Federal authorities also have 
exclusive access to foreign intelligence services and to communications surveillance capabilities 
that will enable them to identify local terrorist conspiracies if they involve connections with 
foreign groups or suspects. That leaves self-recruited, unconnected extremists who are the tar- 
gets of FBI investigations and stings. According to this view, local police departments, whose 
information regarding such threats is often limited to what federal agencies tell them, are mere 
adjuncts to the federal intelligence effort. This dynamic has sometimes led to leaving the locals 
out of the loop altogether. 

Local authorities continue to complain that operational threat information does not get 
to them and that what they do receive is so broad as to be “unactionable.” The Boston case 
illustrates the problem. The local authorities are deluged with generalized reports that have 
little utility other than to allow federal agencies to pretend that they are sharing information. 

Fusion centers are supposed to collate information from different sources at the local 
or regional level, but for a variety of reasons, information does not routinely move laterally 
between the centers and police departments in various parts of the country. The highly local- 
ized nature of most terrorist plots uncovered in the United States, even those inspired by 
al Qaeda, makes this shortcoming less notable. Thus far, terrorists in one part of the country 
have rarely been connected with terrorists in other parts of the country. Therefore, the lack of 
lateral cooperation is not seen as a critical shortcoming. The most notable exception has been 
the al Shaba’ab recruiting of volunteers in the Somali communities of cities in Minnesota, 
California, and other states. Were more such groups to operate across state lines—as Hezbol- 
lah, Mexican cartels, and some purely domestic groups do—agencies would have greater dif 
ficulty sharing information with other jurisdictions that have an interest in the threat stream. 


| Much of the discussion centered on federal/local information sharing, but the group agreed that federal-to-federal inves- 
tigative sharing is also lacking. Investigative sharing among federal law enforcement entities can still too often be charac- 
terized by turf protection (“It’s my case”); and there are big gaps in information-sharing outlook, practice, and capabilities 
between federal agencies that are part of the intelligence community (most of the FBI) and those that for the most part 
are not (DEA, ICE, Customs and Border Protection [CBP], etc.). CBP collects a vast trove of information under its border 
authorities; the percentage disseminated to the intelligence community is small. And non—intelligence community federal 
officials often don’t read intelligence reports because they cannot use them in court. 
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Does the JT TF system work?!? The general consensus of the meeting participants is that 
the system does work, but not perfectly. A number of the participants were critical of it. After 
being beaten up for several years after 9/11, the FBI managed to retain the intelligence mission, 
observed one participant, but it “is still operating the way it was before 9/11, that is, operat- 
ing as a case-oriented law enforcement organization. Field offices haven’t changed that much. 
They still act much as they did before 9/11. They haven’t figured out intelligence.” Another 
participant observed that “one analogy to the FBI’s evolution from purely law enforcement to 
an intelligence organization is of a pick-up truck fitted with aftermarket products to improve 
its handling, give it a shiny paint job, and increase its horsepower, all things that improve its 
performance. But at the end of the day it is still a pickup truck.” The FBI has adjusted to its 
new mission focus, but its primary mission is the one it has been doing for a hundred years: 
law enforcement. 

One participant was critical of the FBI for “having failed in creating a nurturing relation- 
ship between the federal and local levels of government.” Another participant thought that 
the JT'TFs have become too much an extension of the federal government. Either way, the 
JT TFs are not the investigative partnerships initially envisaged. Local police departments are 
pulling back from the JTTFs because the federal authorities don’t share, they don’t assist local 
departments, or the FBI members see them as mere extensions of the federal government. The 
departments want better partnerships with the JT TFs or new partnerships outside of them.!% 

The JIT Fs operate under rules, some of which inhibit cooperation in the name of civil 
liberties and prosecutorial constraints. Moreover, each JTTF is unique. Local relationships 
often depend on local personalities. Federal and local entities have very different legal authori- 
ties and institutional cultures. Both have come to the conclusion that these differing authori- 
ties and cultures create the big divide between the two levels. In some ways, that may not be 
such a bad thing. The FBI is a highly focused organization with centralized priorities, hierar- 
chy, and rules. Local police are focused downward, on their communities, with which they 
are intimately familiar. Indeed, even as FBI outreach has accelerated over the years, it has not 
had much success penetrating closed, often ethnic communities within local jurisdictions. The 
police and local authorities often are able to engender more trust among the local population.“ 

There are also differences in rules. While some of the participants pointed out that the 
FBI can collect information that has no nexus to cases, others noted that it cannot do what 
locals can do. The FBI has a high threshold for triggering an investigative case. Local depart- 
ments have lower thresholds, described as “a possibility of criminality” or “a reasonable suspi- 
cion of a criminal predicate,” enabling them to investigate nascent threats that might not trig- 
ger the FBI’s higher threshold for opening an investigation.!5 


12 JTTFs are based in 103 cities nationwide, and there is at least one in each of the FBI’s 5G field offices. Nearly three- 
quarters of the JI'TFs were created after 9/11. JT'TFs consist of cells of investigators, analysts, linguists, and experts from 
across the U.S. law enforcement and intelligence agencies. 


'3 As an example of efforts to negotiate better partnerships, the Los Angeles Police Department (LAPD) and the FBI 
recently negotiated an agreement increasing transparency between them, including to cases being examined by other JT TF 
squads and vice versa, a concerted effort to refer to the LAPD those FBI terrorism-related cases that are closed or put on the 
back burner and to give it the ability to benefit from national-level databases. 


4US. Department of Justice, 2005. 


15 However, the FBI’s revised Domestic Investigations Operations Guide, issued in December 2008, permits an “assessment” 
for intelligence purposes—that is, even where there is “no particular factual predication” that a crime is being committed.” 
Lieberman and Collins (2011) criticized the FBI for focusing exclusively on the question of whether Major Nidal Hasan was 
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Still, the JTTFs are currently the only mechanism operating as a national platform of 
domestic intelligence collection, even though they have a long way to go to fulfill that mis- 
sion. The question is, How can the JTTFs leverage more out of state and local law enforcement 
capabilities? Are fusion centers the right vehicle? Few participants thought so. 

While information sharing is probably progressing (notwithstanding perennial challenges 
in navigating the federal/local divide), investigative sharing is a different case, one that the con- 
ference participants believe could improve the coverage of potential (and potentially dormant) 
threats. Twenty thousand eGuardian" leads are passed to the JTTFs each year. These are tips 
from FBI field offices and legal attaché offices overseas that are tracked, triaged, searched, and 
analyzed by FBI headquarters (and often submitted to one of the JIT Fs for further action). 
One such lead was the Russian information passed to the FBI and investigated by the JTTF 
in Boston. The 2011 investigation showed no link to terrorist activity by the Tsarnaevs (the 
Boston Marathon bombers) and thus was closed and expunged from the system.!” The vast 
majority of the leads, however, are resolved quickly, with few significant findings. 

Would the outcome have been different if the JTTF passed such leads, so-called “closed 
cases,” or tips it receives from other federal organizations to the local agencies? The answer 
often given is that JT TFs cannot do that, but the reason why is a bit murky—is it a legal or a 
policy decision? ‘The cases are closed for privacy reasons, but this is likely the result of a policy 
decision and not a legal requirement. Should the FBI pass closed cases to local law enforcement? 

It is easy to be in favor of catching terrorists, but as one of the participants noted, “If it 
was your kid and the FBI investigated him and found no wrongdoing, how would you feel 
about the lead being passed to the local police to follow up? At what point does following up 
start feeling like harassment?” Nevertheless, the issue is worth further discussion. What tips 
can the FBI pass to its local partners, and what should the partners do with the information? 
At what point are closed cases really closed? And does closing a case mean memory loss? 

Some participants argued that the FBI can now disseminate intelligence that is not con- 
nected to a specific criminal investigation. But others pointed out that there were still a number 
of impediments to sharing federal information with local authorities. Government policy will 
not allow the FBI to hand over cases to the locals. One participant challenged this restriction 
as being a matter not of law but of the current interpretation of the law, which can change 
according to the political climate. In the years immediately after 9/11, the FBI would tell the 
Department of Justice (DOJ) what it needed to do to prevent another terrorist attack. Now the 
roles are reversed, and the atmosphere in DOJ is again becoming legalistic. 

‘There seemed to be a general consensus that the issue should not be framed as one of 
information sharing; rather, the objective should be co-production of intelligence. It is about 
sharing investigative activities. 


engaged in criminal terrorist activity and not on the broader intelligence question of whether Hasan was radicalizing to the 
extent that he posed a terrorist threat. 


'6 eGuardian is an FBI system launched in January 2009 to share tips about possible terrorist threats with local police 
agencies. 


'7 eGuardian, by contrast, is a relatively new system designed to allow local law enforcement agencies to pass suspicious- 
activity reports to the local fusion center, where personnel evaluate and either monitor, close, or refer the case to the appro- 
priate JT'TF. Once the JTTF determines there is no terror nexus, the report is deleted to ensure that personal data are not 
stored needlessly. 
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From this perspective, threat definition is a central issue. JTTFs are organized with a 
narrow and intense focus on terrorism.'8 This artificial separation of “threats” by source makes 
little sense in today’s connected world. Terrorists, organized-crime cartels, cyber criminals, 
and other threats use similar weapons, travel routes, money handling, and other techniques. 
Perhaps it is time to consider binning them by other criteria. The transnational Mexican cartels 
and the Colombian drug lords in many ways act as terrorist groups, but they are not terrorists, 
so different sharing mechanisms apply. Terrorism, narcotics, crime, and domestic terrorism are 
related, if not by direct relationships, then by the data analysts use to make sense of the threats 
they pose. Yet efforts against those threats are strictly compartmented. 

Finally, first responders remind us that information sharing is not simply about prevent- 
ing attacks but is also crucial to managing the consequences of an attack. In this regard, the 
Boston case provides clear evidence of the progress made in sharing information broadly—not 
simply between the federal and local law enforcement communities, but with first responders, 
hospitals, and the private sector. Boston was perhaps better prepared than many other cities to 
respond to an attack, and the response was well coordinated, well conceived, well planned, and 
well executed. The Boston case also displayed the advantages not only of passing information 
but also of integrating operations. That, at the end of the day, was what made the response to 
the attack so successful. 


Fusion Centers 


There is continuing uncertainty about the role of the fusion centers in intelligence and skepti- 
cism about their value. Originally thought of as clearinghouses, they are supposed to be focal 
points for analysis and synthesis of local intelligence efforts, but many do not work as designed. 
In the opinion of one of the participants, perhaps fewer than 24 of the nation’s 77 fusion cen- 
ters are really performing well. Some participants saw fusion centers, at least potentially, as 
part of a national intelligence capability, but others thought they should not be woven into the 
national intelligence effort. 

With encouragement, support, and funding from DHS, intelligence fusion centers pro- 
liferated after 9/11. Although DHS funds them, it has no authority over them. They were ini- 
tially seen as the primary vehicle for enabling domestic information sharing, which sometimes 
seemed a politically safe alternative to domestic intelligence collection. This politically correct 
view ignores the fact that sharing information requires its initial collection by police or fed- 
eral entities. At the same time, some have criticized the fusion centers for not collecting intel- 
ligence, which they were generally not intended to do,'? although a few evolved from criminal 
intelligence centers and do have a collection role. 


18 Terrorism is defined by the FBI as “the unlawful use of force and violence against persons or property to intimidate 
or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.” 
Domestic terrorism is defined as “the unlawful use, or threatened use, of force or violence by a group or individual based and 
operating entirely within the United States or Puerto Rico without foreign direction committed against persons or property 
to intimidate or coerce a government, the civilian population, or any segment thereof in furtherance of political or social 
objectives” (Federal Bureau of Investigation, undated). 


19 U.S. Government Accountability Office, 2013. 


Identifying Enemies Among Us_ 13 


Congress proclaimed in 2012 that most fusion centers were underperforming and con- 
tributed too little to the nation’s situational awareness of terrorist threats.2° The congressional 
report seemed to focus on only one question, and perhaps the wrong one: How much were 
fusion centers directly or not directly involved in catching terrorists? 

Adding even more confusion, the centers have evolved in very different directions, dic- 
tated by local circumstances and needs. Their priorities are more a function of what their state 
and local stakeholders want than of what Congress or the federal homeland security commu- 
nity (DHS, FBI, the intelligence community) thinks the centers should do. 

Fusion centers are not all created equal. The notion that “if you've seen one fusion center 
you've seen just one fusion center” has merit. No two fusion centers seem to have the same 
processes, products, priorities, or performance metrics. They are designed to serve their local 
customers, not federal consumers, and certainly not the intelligence community in Washing- 
ton. While some are seen to serve their customers well, others (perhaps the majority, although 
that conclusion would require far more detailed research) are not. This study in contrasts is a 
telling commentary on the uneven performance of the centers. 

The result is that when asked, What has a fusion center done for you lately?, the answer 
from virtually anyone in a federal bureaucracy is, Nothing. That may be consistent with the 
way the system was designed, but it seems inconsistent with both the current budget environ- 
ment and the diminished (or, at the very least, changed) foreign terrorist threat environment. 

Nevertheless, this bottom-up approach could clearly have benefits. Presumably, the fusion 
centers are responsive to their local sponsors; the governor, state homeland security agencies, 
and police and sheriff's departments can shape their centers to their own needs, allowing each 
local entity to determine the nature of the center in its area. Meeting participants reflected 
that satisfaction with fusion-center support, however, is mixed. Albeit derived from a limited 
sample, most first-hand experiences with fusion centers were poor. Most of the federal-level 
participants observed that the centers were at best inconsistent, with little quality control and 
no follow-through. Local police experiences were mixed but also generally negative. “With 
six guys following 53 portfolios, you don’t expect much expertise.” “Why would I contact the 
fusion center when the JTTF is more responsive and far more expert?” And even first respond- 
ers seem to find little value in their interactions with the centers. These observations, although 
from a small and unscientific sample, seem consistent with our general observations over the 
years. 

Duplication of effort seems wasteful. Without a linked network to draw from, person- 
nel at each fusion center tend to think they have to do everything. That means dealing with 
all hazards all of the time, something the largest centers might manage, but the smaller ones 
cannot. 

Top-down guidance may be useful, but top-down control is not. An alternate model to 
adjust the fusion centers could be based on providing guidance rather than prescription. The 
first principle would be to let state and local authorities determine their needs and provide the 
supporting resources. Low-performing centers would wither away; high-performing centers 
would service more than their limited region and their local patrons. ‘The federal role—fund- 
ing, guidance, and information flow—needs to be determined top down and needs to be more 
selective and performance-based. 


20 Permanent Subcommittee on Investigations, 2012. 
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This market approach might be a practical approach for the centers, one in which the 
rules and nodes of expertise would emerge, replacing the current system. In the smallest cen- 
ters, there might be a few people trying to cover dozens of portfolios and thus doing all of them 
badly. If, instead, there were an information market, some of the larger centers would have the 
capacity to cover many issues. Other centers would develop specialty expertise—notionally, 
San Diego on Pacific maritime issues, Kansas City on explosives, Arizona on illegal immi- 
gration, Los Angeles on drug-trafficking gangs, and so forth. The centers would rely on one 
another for deep expertise in particular areas. 

This would also have the benefit of encouraging collaboration and communication 
between and among the centers that remained, with a more national focus and the ability 
to paint a more nationwide threat picture. This system would encourage development of a 
common database that would enable analysts to look more broadly at nationwide trends and 
detect commonalities and linkages between regions that are not visible today. 

Can fusion centers become real intelligence platforms? For that to happen, their person- 
nel need to be trained and infused with intelligence doctrine. The FBI’s Field Intelligence 
Groups are currently not part of fusion centers. The two sets of entities do not interact. But 
no one at the meeting thought that the 56 Field Intelligence Groups should embed within the 
fusion centers. 

Integrating the two entities would require an investment. Spending more federal money 
on fusion centers seems unnecessary, unwise, and, given budget constraints, unlikely. Budget 
constraints may reduce federal support anyway. The majority view seemed to favor letting 
nature take its course. Some fusion centers play a key role in bringing together terrorist infor- 
mation. Some are promoters of intelligence-led policing. Some are moving toward all-hazards 
response centers. Some may consolidate. Some will disappear. 


Possible Roles for the Director of National Intelligence 


One theme that ran through our discussions was the role of the DNI in homeland security. 
The DNI has responsibilities for capacity building across the intelligence enterprise, reducing 
redundancies, and distributing information, but a decade after the formation of the agency, it 
has yet to be determined whether and how the DNI fits into the domestic intelligence archi- 
tecture. Most who work in the Office of the DNI come from the foreign intelligence world. 
Involvement in what is invariably described as “spying on Americans,” regardless of legality, 
is seen as “not a good optic.” While our discussion group did not tackle this question directly, 
participants discussed several possible roles for the DNI. They include the following: 


¢ Increase outreach between the intelligence community and appropriate state and local 
entities to familiarize each with the capabilities and priorities of the other. This could 
begin to develop a culture of communication and better understanding between these 
two communities that have many of the same core missions. 

¢ Assist in training state and local entities. This could include an emphasis on analytic 
tradecraft, which representatives of local law enforcement emphasized they currently lack. 

¢ Build on existing federal-local partnerships that include law enforcement and first 
responders to develop relationships and improve collaboration—and ultimately, to prove 
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that it can be done. The NCTC’s Joint Counterterrorism Assessment Team was cited as 
a good example. 

¢ Provide a broad prioritization protocol for the fusion centers—a compass of sorts to help 
aim their activities: Which threats are most imminent? Most serious? 

¢ Designate, advocate, and support the use of common information-sharing mechanisms 
for non-counterterrorism issues similar to the NCTC Current platform, which provides 
(at both top secret and secret levels) a centralized and comprehensive repository of terror- 
ism information available at those levels. 

¢ Assist state and local organizations with tasking to support national collection systems. 

¢ Become a sponsor of the Organization of Major Chiefs of Police, which spans 63 cities, 
73 million people, and 177,000 police officers. Having exposure to this organization and 
a more regular intelligence-community relationship would be good for both state and 
local agencies. 


Findings and Suggestions 


As indicated at the outset, the meeting was not intended to achieve consensus views. Nonethe- 
less, the following areas of agreement emerged: 


1. The terrorist threat has changed, although disagreement about its direction and scope 
persists. From a strategic perspective, it is clear that al Qaeda is greatly diminished; its 
ability to launch another catastrophic attack on the scale of the 9/11 attacks has been 
substantially reduced. The terrorist threat is now more diverse and complex, but from 
a local perspective, it is still challenging and dangerous. Moreover, it seems likely to 
persist. 

2. Local law enforcement focuses on how the terrorist threat is manifested within the com- 
munities the agencies protect. Violence spreading to new regions overseas can impact 
local U.S. communities, sparking radicalization and eventually violence. The global 
jihad is no longer the sole organizing principle behind this violence. Rather, locally 
focused al Qaeda offshoots in Yemen, Iraq, Somalia, and North Africa and emerging 
extremist groups and conflict elsewhere in places like Nigeria and Mali and the coun- 
tries affected by the Arab uprisings, especially Syria, are the concern of not only our 
foreign-focused federal agencies but also homeland security agencies and state and local 
entities. 

3. ‘The standard intelligence categorization of threats by group and compartmentalization 
by origin (terrorism, domestic terrorism, cyber terrorism, etc.) may unduly limit sharing 
and cooperation across agencies and pertains more to the past threat than to the likely 
future threat. The cyber threat, organized crime, narco-traffickers, and terrorists might 
eventually intersect, yet the law enforcement and intelligence agencies that cover them 
are disconnected—the intelligence community is not positioned to detect an intersec- 
tion among these disparate groups. 

4, Building national resilience will require a more composed and nuanced national dia- 
logue that starts in Washington. The rigid diktat that all terrorism must be prevented 
and Washington’s tendency to focus on fault-finding rather than improving perfor- 
mance are counterproductive. 
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10. 


11. 


The JTTFs remain the central construct of the domestic counterterrorist structure. Better 
investigative cooperation with state and local entities could be achieved by determin- 
ing why the relationships between the JTTFs and local police are limited and removing 
unnecessary obstacles that prevent consistent and quality cooperation between them. 
‘The source of these obstacles is often obscure—some are legal, some result from policy, 
and some are purely cultural. True legal obstacles would be difficult and cumbersome to 
remove, the others less so. For example, the FBI believes it cannot pass closed eGuardian 
leads, “tech hits,” or similar information to local police for follow-through. Why not? 
It is important to remember that some of the obstacles that limit cooperation, infor- 
mation sharing, and collaboration among the various layers of government were put in 
place for good reason. Privacy and civil-liberties protections are getting more attention, 
not less, and thus must be at the forefront in rethinking relationships and breaking 
down barriers. 

Privacy and civil liberties (notwithstanding the current furor) should not be used as a 
blanket excuse to keep the intelligence community and local law enforcement apart. 
We should think about how to smartly remove barriers that prevent cooperation and 
communication between these two communities that have so much to benefit and learn 
from each other. 

The intelligence community has much to offer local police in terms of analytic 
tradecraft, understanding the adversary, national-level technical collection, and the like. 
At the same time, local law enforcement has much to offer federal intelligence agencies. 
The DNI could take a lead role in establishing guidelines for shaping these relationships. 
‘The fusion centers seem to fall short both with their local customers and in contributing 
to the national-level counterterrorism effort. Some fusion centers are performing well, 
but many, it seems, are not. Some sort of market system that reduces duplication, har- 
nesses existing expertise, encourages more cooperation, and normalizes protocols could 
reduce costs and improve effectiveness. However, the future of the fusion centers—their 
survival in a budget-constrained environment and their missions—remains an issue for 
the states. 

It is difficult for the DNI or other national intelligence structures to talk about domes- 
tic terrorism—not homegrown terrorists inspired by foreign ideologies like that of 
al Qaeda but purely domestic violent extremists on the far left or far right of the politi- 
cal spectrum or motivated by specific issues. National security is defined as a foreign- 
power nexus, meaning a foreign-intelligence focus. When the intelligence community 
gets into domestic terrorism, it does so knowing that risks are involved. ‘This is a per- 
ception issue. Most of the federal intelligence-community bureaucracy cannot deploy 
against Americans, although the FBI has a mandate and a long history of pursuing 
domestic terrorist groups, as does the Bureau of Alcohol, Tobacco and Firearms, but for 
other federal agencies with intelligence responsibilities, political discomfort and optical 
challenge arise, only more so. As one participant put it, “If it ain’t al Qaeda, it ain’t.” 
‘The group seemed to believe that the nation’s zero tolerance for terrorism will soon 
come into direct conflict with the need to reduce budgets, including, perhaps for the 
first time, to consider real declines in counterterrorism funding. This raises a broader 
question: What is the end state? Must the nation realistically tolerate some level of ter- 
rorist risk, and if so, what is that level? 
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